We already have a very large number of SharePoint sites, and currently anyone in the organization can create another one. Completely blocking self-service creation may be difficult politically, but the current setup has created a serious governance problem: we cannot confidently identify which sites contain important business data. We are considering designating certain sites as official repositories with formal ownership, permissions, naming, retention, and oversight, then expanding that model over time. How do other organizations balance user self-service with data governance and site sprawl?
5 Answers
Before deciding whether to block creation, inventory what already exists. Look for inactive sites, sites with no owners or only one owner, broken permission inheritance, broad sharing links, and externally exposed content. That will give you a much better picture of the actual risk than simply counting sites. Use the results to identify official repositories and prioritize remediation.
Self-service can work if ownership and lifecycle management are enforced. Require two owners, a clear naming convention, a business purpose, data classification, and an expiration or renewal date. Send reminders before expiration, disable access when a site expires, and retain it for a defined recovery period before deletion. Sites with no owners or no activity should be flagged automatically rather than left indefinitely.
Uncontrolled creation usually turns into abandoned groups, duplicate sites, missing owners, inconsistent permissions, and Teams-created SharePoint sites that nobody remembers approving. I would at least restrict who can create Microsoft 365 groups and Teams, since those commonly create associated SharePoint sites. Require a ticket or catalog request for exceptions, with department management involved.
The hidden connection to Teams is easy to miss. Even if standalone SharePoint creation is restricted, users may still create sites indirectly through other Microsoft 365 services.
A practical middle ground is to give each department one governed site that it owns and maintains. Anything outside that structure requires an approval request. This reduces duplication and makes responsibility clear, while still letting departments manage their own content without making IT the owner of every document.
We do not allow unrestricted creation. Users submit a request through an approval workflow, which records the business purpose, owners, department, naming convention, classification, and expected lifecycle. Once approved, automation provisions the site from a standard template. This keeps IT from manually building every site while still giving the organization an audit trail and consistent controls.
That kind of provisioning system is probably the best compromise: users still get what they need, but creation is not completely unmanaged.
The important part is automation. Annual manual cleanup becomes nearly impossible once the tenant has thousands of sites.